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Abstract 

We study the nonlinearity and the weight of the rotation- symmetric (RotS) 
functions defined by Pieprzyk and Qu || . We give exact results for the nonlinearity 
and weight of 2-degree RotS functions with the help of the semi-bent functions || 
and we give the generating function for the weight of the 3-degree RotS function. 
Based on the numerical examples and our observations we state a conjecture on the 
nonlinearity and weight of the 3-degree RotS function. 
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1 Motivation 



Hash functions are used to map a large collection of messages into a small set 
of message digests and can be used to generate efficiently both signatures 

and message authentication codes, and they can be also used as one-way 
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functions in key agreement and key establishment protocols. There are two 
approaches to the study of hash functions: Information Theory and Com- 
plexity Theory. The first method provides unconditional security - an enemy 
cannot attack such systems even if he/she has unlimited computing power. 
Unfortunately, this is still a theoretical approach and is generally impracti- 
cal ]|] . In the second method based on complexity theory, some assumptions 
are made on the computing power of the enemy or the weaknesses of the 
existing systems and algorithms. The best we can hope for is to estimate the 
computing power necessary for the attacker to break the algorithm. Recent 
progress in interpolation cryptanalysis Q and high order differential crypt- 
analysis H has shown that the algebraic degree is an important factor in 
the design of cryptographic primitives. In fact, in |5| the algebraic degree is 
the crucial parameter in determining how secure certain cryptosystems are 
against higher order differential attacks. Together with propagation, dif- 
ferential and nonlinearity profile, resiliency, correlation-immunity, local and 
global avalanche characteristics they form a class of design criteria which we 
have to consider in the design of such primitives. 

In ||, Pieprzyk and Qu studied some functions, which they called rota- 
tion-symmetric (RotS) as components in the rounds of a hashing algorithm. 
It turns out that the degree- two RotS function takes 3 "^~ 1 + 6 (to — 1) opera- 
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tions (additions and multiplications) to evaluate in m consecutive rounds of 
a hashing algorithm. In the authors showed how to break in less than 20 
milli-seconds a block cipher that employs low algebraic degree (quadratic) 
Boolean functions as its S-boxes and is provably secure against linear and 
differential attacks. Therefore, it is necessary to employ high degree RotS 
functions in our algorithms. To protect from differential attack, we need 
RotS functions with high nonlinearity. In this paper we aim to complete 
the study begun by Pieprzyk and Qu || on the two-degree RotS functions 
and we construct the three-degree RotS functions and we prove some results 
about their weights and nonlinearity. 

2 Preliminaries 

Let n > 6 be a positive integer and W n = {0, l} n be the space of binary vec- 
tors. Denote ao = (0,... ,0, 0),«i = (0,... ,0,1),... ,a2 n -i = (1, • • ■ , 1)- 
We use the lexicographical order on the sequence a, that is «o < a i < • • • < 
a!2 n -i- The Boolean functions will be written in their algebraic normal form 
(when a = (a±, . . . , a n )) as 

where c a G W\. The truth table of / is the binary sequence 

/ = {V\,V 2 , • • • ,V 2 n), (1) 



where the bits v t = /((O, ... ,0)), v 2 = /((O,... ,0,1)),. .. . We shall iden- 
tify the function / with its vector representation in ([T|). We call a function 
balanced if the number of ones is equal to the number of zeroes in its truth 
table. The Hamming weight of a binary vector v, denoted by wt(v) is de- 
fined as the number of ones it contains. The Hamming distance between 
two functions f,g : W n — > W%, denoted by d(f,g) is defined as wt(f © g). 
The nonlinearity of a function /, denoted by Nf is defined as 

min d(f, (f>), 
<t>&A n 

where A n is the class of all affine function on W n . We say that / satisfies 
the propagation criterion (PC) with respect to c if 

£ f(x)(Bf(x(Bc) = T- 1 . (2) 

If / satisfies the PC with respect to all vectors of weight 1, / is called an 
SAC (Strict Avalanche Criterion) function. If the above relation happens 
for any c with wt(c) < s, we say that / satisfies PC(s), and if s = n, 
then we say that / is a bent function. If two functions g, h, on W n , satisfy 
g(x) = h(Ax © a) © (b ■ x) © c with a, b G W n , c G W\, and A a 2k x 2k 
nonsingular matrix, we say that g is affinely equivalent to h. 

Definition 1. The class of rotation-symmetric (HotS,) functions includes 
all Boolean functions f : W n — > W\ such that f(x±, ... , x n ) = f(p(xi), . . . , 



p(x n )), where p(xi) = x i+ i, and x n+ i := x\. 

As in || , we denote by p the permutation p(i) = i + l,p(n) = 1. By 
abuse of notation we use the same letter for the transformation which acts on 
each variable by p(xi) = Xi + \,p{x n ) = x\. By g we mean (— I) 9 . We define 
the Walsh- Hadamard transform of a g € W n to be the map T g : W n — > R, 

taw = E 9(x)(-ir x . 

The correlation value between g and h it is defined by 

If {7 is a string of bits, then [7 denotes the complemented string with 
and 1 interchanged. If X is a 4-bit block or a string of blocks, by (X) u or 
X u we shall mean the string obtained by concatenation of u copies of X. 
The concatenation of two strings u, v will be denoted by uv or u\ \v. Now we 
define two sets of 4-bit strings 

Ti = {A = 0, 0, 1,1; A = 1, 1, 0, 0; B = 0, 1, 0, 1; B = 1, 0, 1, 0; 

C =0,1,1,0; C = 1,0,0,1; D = 0, 0, 0, 0;D = 1, 1, 1, 1} 

and 

T 2 = {U =1,0,0,0; [7 = 0,1,1,1; ^ = 0,0,0,1; V = 1, 1,1,0; 

X =0,1,0,0; X = 1,0,1,1; 3T = 0,0,1,0; Y = 1, 1,0,1}. 
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3 The second degree rotation-symmetric function 

In H the authors proved that the homogeneous rotation symmetric function 
of degree 2, fi = x\x\ + X2£z+i + • • • x n x n +i-i, (the subscript w is taken as 
{[w — 1) mod n) + 1) has good nonlinearity and good avalanche properties. 
Precisely, they proved 

Theorem 2. The function fi has the following properties: 

(i) the Hamming weight satisfies 2 n ~ 2 < wt(f) <2 n — 2 n ~ 2 , 

(ii) the nonlinearity satisfies Nj 2 > 2 n ~ 2 , 

(Hi) if n is odd, then Nf 2 = 2 n ~ — 2~ 2~ and /2 is balanced, 

(iv) the function satisfies the PC with respect to all vectors a of weight 
< wt(a) < n. In particular f is an SAC function. 

In the same paper it is proved that 

Theorem 3. // fk is an RotS function of degree k, then the nonlinearity 
satisfies N fk > 2 n ~ k . 

Now, we evaluate the nonlinearity of fi for n even. 

Lemma 4. For n > 3, let t n = x\X2 + £223 + ■ ■ ■ + x n -2X n -\ + x n -\x n . 
Then t 2 k is a bent function. 



7 

Proof. We have 

t 2k =x 2 (xi + x 3 ) + x 4 (x 3 + x 5 ) H h 

X2k-2(x2k-3 + ^fc-l) + X 2 kX2k-l- 

By taking the transformation 
X 2i = x 2 i and X 2i _i = z 2 i-i + ^2i+l,^2fc-l = »2fe-l) « = 1, 2, . . . , fc - 1, 

we see that t 2 k is affinely equivalent to a bent function in the Maiorana- 
McFarland class (see Q), therefore it is also bent. □ 

We say (see [||) that g £ W2k+i is semi-bent, if there is a bent function 
9o G W 2fc with 

5 = 5o|bi, 

where g\{x) = go(Ax a) © 1, vl is a nonsingular 2k by 2k matrix and a is 
any vector in W 2 k- 

In [0, the authors prove the following results (see Theorem 18, Corollary 
21 and Theorem 16), which will be used in this paper. 

Lemma 5. Any semi-bent function g € W2k+i is balanced, N g = 2 2k — 2 k , 
for any w* € W^ifc+lj the correlation value between g and the linear function 
l w *(x) = w* ■ x is or ±2~ k , and 

#{w* eW 2k+1 \c(g,l w *) = 0} = 2 2k = #{w* eW 2k+1 \c(g,l w * =±2~ k }. 
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Lemma 6. Let g £ W^+i be a semi-bent function with A = I and a = 
(1, 1, ■ • ■ ,1). Then g satisfies PC (2k). 

Lemma 7. If g is the concatenation <?o||<7ij w * = ( w ) w 2n+i) £ W n+ \, then 

The following result belongs to Preneel 0. We define h(x) = b ■ x. 

Lemma 8. For h on W n , a,b € W n ,c € W\ and a 2k x 2k nonsingular 
matrix A, define g by g(x) = h(Ax © a) © h{x) © c. Then, 

£ s (w) = (-i) c (-i) (A " la '^® &) ^((A- 1 )*( w e b)). 

It is not very difficult to observe (see also ||) that any 2-degree rotation- 
symmetric function in n variables is affinely equivalent to f£ = fi = x\X2 © 
^2^3 © ■ • • © x n -\x n © x n x\. We show below that is not bent. To do that 
we display an algorithm to evaluate fast. For that we need the following 
lemma, which can be proved by considering the truth table. 
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Lemma 9. Each monomial of degree 2 can be written in the form ^) as 

X{Xj = (D 2 n-i-2 (D 2 n-j-2D 2 n-j-2^ 2J-i-l) ' 

if 1 < i < j < n — 2, 

X{X n —\ = {D 2 n-i-2A 2 n-i-2) 2 i-i ' (*0 

X%Xyi — (-Z^2 n — * — 2 B 2 n — i — 2 ) 1 5 

^n— l^n = V 2 n-2. 

Using (||) we see that 

/ 2 = XlX 2 © X2X3 © • • • X n _iX n © X n Xl = 

L> 2 ™-3 (D 2 n-4D 2 n-4) © (D 2 n-4 (D 2 n-5 D 2 n-5 ) ) 2 © (4) 

(£>2 (IXD)) 2 „_ 4 © (flA) 2 n- 3 © (DB) 2 n- 3 © U 2 ™-2 = 

5 © (L»C) 2 n-3 © = # © (FJ7) 2 n-3 © D 2 n-3 B 2 n-3 , 

where g is the sum of the first n — 3 strings of length 2 n . 

For a string u of length 2 s , s > 4, we denote by u, the string obtained 
by complementing the second half, that is the last 2 S_1 bits of u. It is not 
difficult to observe that the following algorithm will output f 2 = G1HG2IIG3. 

Algorithm f2. 
step 3: gl^VY,gl^XU 
step s: g?^g s i - 1 \\g s i -\i = l,2 
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output: G\ <— <7™~ 4 ,G2 <— g 2 ~ 5 , G3 = G4, where G4 = G2, and write 

/2 = C1HG2HG3 

For instance, the first three steps of the algorithm will produce 

Gi - ((yy)(yy))((yy)(yr)) 

G 2 ||G 3 «- (XUXU)(XUXU). 

Theorem 10. // /2 is defined on W n , with n = 2k, then it is not bent. 
Moreover, the nonlinearity is 

N h = 2 2k ~ 1 - 2 k , 

and the truth table of /2 can be displayed using only 2 ra_3 — 2 operations 
(additions and multiplications). 

Proof. Using the above algorithm, we deduce that the RotS function on 
W n of degree 2 can be be evaluated van — 2 steps, which requires 

(1 + 2 1 + • • • + 2 n ~ 5 ) + (1 + 2 1 + • • • + 2 n ~ 6 ) + 2 n ~ 5 = 2 n ~ 3 - 2 

operations, since at each step s we complement 2 s-2 bits. 

First, we take an example, say /f = VYVYXUXU = £5 + a:ia:5 on W5. 
We see that /| = <4(x)||i4(x© 1) © 1, therefore it is semi-bent. 

It is very easy to see that 

fl k+1 = t 2 k{*2k)\\{t2k{*2k) + xi+ x 2k )- 



11 

But 

2fc-l 

W x 2fc) + x l + x 2k = ^2 XiXi + l + Xl + X2k + 1 = 
i=l 
2fc-l 

= ^ ( x i + 1 )( a; i+l + !) = *2fc(x 2 A; 1), 
i=l 

therefore f 2 k+1 = t 2 k{^. 2 k)\\(t 2 k(^-2k 1) ® 1) is semi-bent. By Lemma ||, 
/| fc+1 satisfies the propagation criterion for all weights 1 < w < 2k. 
Similarly, 

= *2fe-l (X2&-1 ) 1 1 (*2A:-1 (x 2 fe-l) + X 1 + X 2 fc-l). 

Now, we shall use Lemma [7| to compute the nonlinearity of First, 
we observe that 

Hk+l = *2A:(x2fc)||(i2fc(x2fc) + X 2 k)- 

Take A = / and a = (1, 0, 1, 0, . . . , 1, 0). We see that 

W x 2fc) + X 2fc = h h (x\ + 1,X 2 ,X 3 + 1,... , X 2 k-l,X 2 k) 

= (Xl + l)x 2 + X 2 (x 3 + 1) H h (X2fe-1 + l)x 2k . 

We denote the last expression by r(x). Using Lemma ^ we compute the 
Walsh-Hadamard transform 

^(w 2fc ) = (-l) (w ' a) 4 fc (w) = ±2 fc , 

since by Lemma ||, t2fc is bent. 
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For simplicity we set i(x) = ^2fc+i( x 2A:+i) and w* = (w,W2k+i)- Thus, 

£ { {w*) = 4» + (-lr^frW = or ± 2 fe+1 , (5) 

since r and t^k are bent. Therefore, 

N t2k+1 =2 2k -^ i2k+i (w*)\ = 2 2k -2 k . 

By Lemma §, ^i 2k _ 1 ( x 2fc-i) = or ±2 fc . Let w(x) = i 2 fc-i(x) + x\ + s 2 k-l- 
By Lemma ^, 

^(x) = (-l) (x0(1 '° "'^(xell.O,... ,0,1)) =0 or ±2 k . 

Thus, by the same Lemma 0, 

J- /|fc (x 2fc ) = T i2h _ x {^ 2k -l) + (-l) xa *^)(x) = or ± 2 fc+1 , 

which implies = 2 2fc ~ 1 — 2 fc . Therefore / 2 is not bent (any bent function 
in 2k variables has nonlinearity 2 2k ~ 1 — 2 k ~ 1 [2, Th. 13, p. Ill]) and the 
theorem is proved. □ 

Remark 11. We remark that, using the normal form of the function, the 
truth table of f is found using 3n 2 ~ 1 2 n operations (see for a detailed 
discussion). Using the previous theorem we can display the truth table using 
only 2 n_3 — 2 operations, which is a significant improvement. 

Now, we will evaluate the weights of / 2 for any dimension n. We prove 
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Theorem 12. The weights 0//2 are given by 

wt(fi) = 2 n " 1 -2f- 1 (l + (-ID . (6) 
Proof. We recall that / 2 = 5™ ~ 1 fl , 2~ 2 53~ 2 - We show that for any s, 

wt(gt) = 2wt(g s i - 2 ) + 2 s ~ 2 ,i = 1, 2, 3. (7) 
Since ff | = gr^t 1 = 9^^%'^ 

wt(gf) = wtig*' 1 ) + wtig*- 2 ) + wt(g°- 2 ) 

= wt(gr 2 )+wt{gr 2 )+wt{gr l ) + 2 s - 2 -wt{gr 2 ) (8) 
= 2wt(g s t - 2 ) + 2 s - 2 ,i = l 1 2. 

Now, from g| = g^ -1 ^ 1 > we 

wt(gl) = 2 s - l -wt{g s 2 - l )+wt{g s 2 - 1 ) 

= 2 s - 1 -wt{g s 2 - 1 )+2wt{g s 2 - 2 )-wt{g s 2 - 1 ) + 2 s - 2 (9) 

= 2wt(g s 2 ~ 2 ) -2wt{g s 2 - 1 ) + 2 s " 1 + 2 S ~ 2 

= wt(g s 2 )-2wt(g s 2 - l )+2 s - 1 . 

The above equation, for s — 1, produces 

urftor 1 ) = ^(^r 1 ) - 2^t( 5 r 2 ) + 2 s - 2 . (10) 

Now, we add @ plus twice (^0[), and we get 

ti>t(s5) + 2^(< 7 |- 1 ) = tutfoS) - 4wt(g s 2 - 2 ) + 2 s . 
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But it>i(cjt|) = 2wt(g'2~ 2 ) + 2 s-2 . By adding the two previous equations we 
get 

wt(g^) = 2- 1 + 2- 3 - urtCflT 1 ) - ^ (11) 

Replacing (0) into (0) we obtain 

wt(g s 3 +2 ) = 2wt(g s 3 ) + 2 s . 

This together with (||) will give the following recurrence for the weights of 
h- 

wt{fZ)=2wt(ft- 2 ) + 2 n - 2 . (12) 
A generating function for the above recurrence is 



z 7 



32 + 16 z° + 24 z b 

1 -2z 



(13) 



-l + 2z 2 

We can linearize the recurrence by using the transformation 

Vn = Wt(f2) - 2 n ~\ 

thus obtaining the recurrence 

Vn = tyn-2- 

Using the above simple recurrence with u^(/|) = 16 and u>i(/f ) = 24 we 
get a closed formula for the weights of ji in dimension n, namely 

2 n-l _ 2 |-1 d + (-1W 
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and the theorem is proved. □ 

4 The third degree rotation-symmetric function 

As in the case of second degree RotS functions, it is easy to observe that 
any RotS function of degree 3 in n variables, f 3 = is affinely equivalent 
to 



/ 3 = xix 2 x 3 + x 2 x 3 x 4 H h X n XlX 2 - 



(14) 



Now, using a computer program we have determined the nonlinearity of 
on W n , n > 9 which turns out to be the same as its weight. Thus, 



n 


3 


4 


5 


6 


7 


8 


9 


Nfn 


1 


4 


6 


18 


36 


80 


172 



We shall assume that n > 10. The following lemma will be used. 
Lemma 13. The truth table of any monomial ■ ■ ■ Xi s of degree s is 

if 1 < h < • • ■ < is < n — 2, 

( y D 2 n-i l -2 ■ ■ ■ (D 2 n-i s _ 1 -2M 2 n-i s _ 1 -2) 2 i s _ 1 -i s _ 2 -l) 2il _ 1 , (15) 

where M = A or B if i s = n — 1, respectively i s = n, 

{D 2 n-i x -1 ■ • • (D 2 n-i s _ 2 -2V 2 n-i s _2-2^ 2 i s _ 2 -i s _. A -l} 2il _ 1 , 

if is-i = n — 1 and i s = n. 
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Proof. Straightforward using the truth table. □ 
Using the above lemma we write 

XiXi + \Xi+2 = (D 2 n-i-2 (£> 2 ™-i-3 (D 2 n-i-4.D 2 n-i-3))) 2 i_! , (16) 

if i < n — 4, and 

X n -3X n - 2 X n -l = (D 3 A) 2 n-4 

X n - 2 X n -lX n = (DV) 2 n-3 (17) 

X n -lX n Xl = D 2n -zV 2 n-3 

X n X 2 X\ = D 2 n-3jt_ 2 n-4,B 2 n-4 

Therefore, 

n— 4 

h = ^2 (D 2 -n-i-2 +2 n-i-3 +2 n~i-4D 2 n-i-4 S ) 2i _ 1 © (D^A) 2 n-4 © 

i=\ 

2 n — 3_i_ 2 n — 4B 2 n—4 © D 2 n— 3 V 2 n— 3 — 

n— 4 



i=l 

(DV DY) 2 n-4 © D 2 n-3 V 2 n-4X 2 n-4 = 

n— 4 

^ ] (-D 2 n-i-2 + . 2 n-i-3 +2 n-i-4-D 2 ra-i-4) 2i _ 1 



i=l 



(£» 3 C) 2 n- 5 (W) 2 „_ 8 (^3^) 2 n-6 = #1 1 | #2 1 1#3 1 1#4, 

where i?i (on W„_i), i? 2 (on W n - 2 ), #3, #4 (on W n _3) are defined by the 
following algorithm (u, on Wj, is the string obtained from u by complement- 
ing its last 2 J ~ 2 bits): 
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Algorithm f3. 
step 4: h\ «- WDY ^ <- VDVA, h\ «- XBXC 
step s: hj «- /i? -1 ^ -1 

output: i?! <— h r ^ 1 ,H 2 <— h2~ 2 ,H 3 <— /i^" 3 , #4 is i/ie string obtained 

from H3 by complementing its first half, that is H4 = H^, where H§ = 

H 6l H 6 = H 3 . Write f 3 = H^WH^H^. 

As in the case of the 2-degree RotS function we see that we need 
2 2 (1 + 2 + • • • 2 n - 5 ) + 2 2 (1 + 2 + • • • 2 n - % ) + 

2 2 (1 + 2 + • • • 2 n ~ 7 ) + 2 n ~ 4 + 2 n ~ 5 = 3 • 2 2 (2 n " 6 - 1) + 

2 n-3 + 2 n-4 = 2 «-2 + 2 «-4 + 2 «-5 _ 3 . 2 2 

operations to display the truth table of fg. 

We shall evaluate the weight of /| for any s. To do this we will compute 
the weights of each component of /|. We observe that 
K = h\ ; /<; 2 /<; : 7<? '/<; ' and 

H = h^^ 2 ^hf- i K-\i = 1,2, 3. 

Therefore, denoting by u>f the weight of hf, and by wf the weight of hf, i = 
1, 2, 3, we arrive at the following identities: 

wf = 2<" 1 + 2<- 2 -u; s + 2 s - 2 , (18) 
w ? = ^-i+^-i. (19) 



18 



Using Mathematical we obtained the following results on the weights of 
f£ and of each of the four components on dimensions less than 12. 



n 


™*(/ 3 n ) 






wt(hr*) 


wt(h2~ 6 ) 


3 


1 










4 


4 










5 


6 


2 








6 


18 


6 


4 






7 


36 


14 


8 


6 


8 


8 


80 


32 


18 


12 


18 


9 


172 


72 


40 


26 


34 


10 


360 


156 


84 


52 


68 


11 


760 


336 


180 


108 


136 


12 


1576 


712 


376 


220 


268 



(20) 



We have 

wt(fg) = wtW 1 ) + wt{h%- 2 ) + wt(h^~ 3 ) + u»i(/i™- 3 ). 

We show by induction that 

wt{hf) = 2 {wt(h s - 2 ) + wt{h s - 3 )) + 2 s " 4 , i = 1,2, 3, 4. (21) 

From the table ( |20| ) we have the truth of the claim for the first few cases. 
Assume ( pl| ) true for s — 1 and we prove it for s. From (|18|) and (19) and 
by using the induction step we get 

wt(ht) = wt(h s - 1 ) + wt{hl~ l ) = 2 {wt(ht- 2 ) + wtih*- 3 )) + 2 s -\ 

Similarly for h\. Adding these relations we get 

wt(fl) = 2 (wt(ft 2 ) + wt(fi~ 3 )) + 2 s " 3 . (22) 



A trademark of Wolfram Research 



19 



Remark that this equation is true for any s > 6. 

Using the table (pC|), the recurrence ( p^) and MapleQ we get 

Theorem 14. The generating function for the weight 0//3, is 

z 6 

e 1_ z 3 + 4z 4 _j_ 4z 5 



1 -2z 



(23) 



-l + 2z 2 + 2z d 
The series expansion of the above generating function is 

z 3 + 4 z 4 + 6 z 5 + 18 z 6 + 36 z 7 + 80 z 8 + 
+ 172 z 9 + 360 z 10 + 760 z 11 + 1576 z 12 + 0(z 13 ), 

obtaining once again the weights of /Jj 1 , for any dimension. 

Based on our numerical examples, we give the following conjecture. 

Conjecture 15. The nonlinearity of f^ is the same as its weight. 
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